Agentic AI: Retailers Have No Idea What’s About to Hit Them

Many retailers offer shoppers their own proprietary AI agents or shopping bots to enhance customer experience.  Retailers can control their proprietary agents’ actions and the risks associated with them, but this Sheppard Mullin memo points out that a bunch of third-party AI shopping agents are being deployed, and users are creating agents of their own.  Since these agents are beyond retailers’ control, they create a variety of legal and business risks for retailers. This excerpt from the memo identifies some of those risks:

Identification and Authentication of Agents – retailers must identify and authenticate agents to prevent fraud and other potential harms. It will be important to recognize when website traffic is an agent rather than a person. And it will be necessary to authenticate the agent as legitimate. Many third-party or user-created agents may intentionally or unintentionally operate improperly, leading to fraud or other losses for the retailer. Some bad actors may try to mask the fact that it is an agent rather than a person accessing the site.

Authorization – even if an agent is legitimate, retailers must confirm that the agent is authorized to: (1) act on behalf of the user; and (2) confirm the scope of the authorization. If an agent engages in an unauthorized transaction or exceeds the scope of its authorization, losses may result.

Contract Formation – retailers must manage contract formation issues when: (1) an AI agent attempts to transact on behalf of a person who is not a current customer of the retailer and has not agreed to the retailer’s Terms of Service (ToS); or (2) the AI agent is transacting for a current customer under a ToS that has not been updated to address agentic AI usage and to which the user has affirmatively assented. In either case, the user may not have an enforceable ToS for the transaction. Lack of an enforceable ToS may have many legal ramifications. One of the ramifications of this is that some risk mitigations that retailers use (e.g., mandatory dispute arbitration, waiver of class actions/mass arbitration) may be unavailable.

Other issues include whether courts will treat AI agents’ actions as creating legally binding obligations on the part of the purchaser, potential privacy issues associated with third party agents’ causing the platform to share user data, and potentially deceptive practices by the agents.